fedora-selinux / selinux-policy

selinux-policy for Fedora is a large patch off the mainline
GNU General Public License v2.0
156 stars 157 forks source link

Allow certmonger read and write tpm devices (f39) #2193

Open zpytela opened 1 week ago

zpytela commented 1 week ago

Can be triggered by running using ipa-getcert to get a new certificate on a system with an integrated TPM device.

The commit addresses the following AVC denial: type=AVC msg=audit(1708407186.8:1410): avc: denied { read write } for pid=215523 comm="dogtag-ipa-rene" name="tpm0" dev="devtmpfs" ino=142 scontext=system_u:system_r:certmonger_t:s0 tcontext=system_u:object_r:tpm_device_t:s0 tclass=chr_file permissive=0

Resolves: rhbz#2265390